Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    07-12-2023 19:29

General

  • Target

    9e116c7ad15ab3e51b9b076366c9e07249cae7e956df49abe83c5db7e309b81bexe.exe

  • Size

    693KB

  • MD5

    1efe5ce8f6e99361179bff600d2407da

  • SHA1

    3238f5541bd4d9de31b1e3c2ff130a83124f082f

  • SHA256

    9e116c7ad15ab3e51b9b076366c9e07249cae7e956df49abe83c5db7e309b81b

  • SHA512

    ad8d2d20310071fa16ca018814421fb84a8e473f5381e4e3caedfa3e50527160c3fc601e1a9c2eded89fedc741eb11b7d2328f6ad389dce1e104884884a286d2

  • SSDEEP

    12288:KueH5qc86l+Jv2udDznSU5n0CN7G4GVQ/SiNqZGkpCw0lLe:uqhm+h2qSYgk/SighUl

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9e116c7ad15ab3e51b9b076366c9e07249cae7e956df49abe83c5db7e309b81bexe.exe
    "C:\Users\Admin\AppData\Local\Temp\9e116c7ad15ab3e51b9b076366c9e07249cae7e956df49abe83c5db7e309b81bexe.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3036
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\9e116c7ad15ab3e51b9b076366c9e07249cae7e956df49abe83c5db7e309b81bexe.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2288
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\CCgsyDTGfULbmb.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2772
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CCgsyDTGfULbmb" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAA63.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2624
    • C:\Users\Admin\AppData\Local\Temp\9e116c7ad15ab3e51b9b076366c9e07249cae7e956df49abe83c5db7e309b81bexe.exe
      "C:\Users\Admin\AppData\Local\Temp\9e116c7ad15ab3e51b9b076366c9e07249cae7e956df49abe83c5db7e309b81bexe.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2844

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpAA63.tmp

    Filesize

    1KB

    MD5

    16704f4cfc58c21aa1098ac5411d605f

    SHA1

    5f78125fe096e41261910ef3016c64ed7dbb2b13

    SHA256

    b382f105f68a4a637ac41aa0d2682c8ddbad596ff527b833c8449a75ede15358

    SHA512

    c7060f6918fbe6bbccaa0c54e55f3e64a1f2cbc1a51f8eac58f19c7a173131cf28e8a2262f5ae3cff9f8ce2f185594807c604daad41f0d50edaddbef96091c49

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\M72NFGLQSVTHV1AQCE3Q.temp

    Filesize

    7KB

    MD5

    56eef9bfcc4b4e3f675604887991fac8

    SHA1

    3ef0e087291837a70fbb9cb60853de18a46c0eb2

    SHA256

    4acf968bf88f938f4ae7e820bf644611bfcbfb8cee25b7ff88c31f7d54362498

    SHA512

    227cd590a4a04307be8638beaf15fdf907db040bfd97f49c7d073a496b92a69497658fffed08d0bca9d7f98da28c8dbc75a66b750c4b72c1210de365ee3ef271

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    56eef9bfcc4b4e3f675604887991fac8

    SHA1

    3ef0e087291837a70fbb9cb60853de18a46c0eb2

    SHA256

    4acf968bf88f938f4ae7e820bf644611bfcbfb8cee25b7ff88c31f7d54362498

    SHA512

    227cd590a4a04307be8638beaf15fdf907db040bfd97f49c7d073a496b92a69497658fffed08d0bca9d7f98da28c8dbc75a66b750c4b72c1210de365ee3ef271

  • memory/2288-38-0x00000000026B0000-0x00000000026F0000-memory.dmp

    Filesize

    256KB

  • memory/2288-43-0x00000000026B0000-0x00000000026F0000-memory.dmp

    Filesize

    256KB

  • memory/2288-37-0x000000006EED0000-0x000000006F47B000-memory.dmp

    Filesize

    5.7MB

  • memory/2288-33-0x000000006EED0000-0x000000006F47B000-memory.dmp

    Filesize

    5.7MB

  • memory/2288-45-0x000000006EED0000-0x000000006F47B000-memory.dmp

    Filesize

    5.7MB

  • memory/2288-35-0x00000000026B0000-0x00000000026F0000-memory.dmp

    Filesize

    256KB

  • memory/2772-44-0x0000000002690000-0x00000000026D0000-memory.dmp

    Filesize

    256KB

  • memory/2772-46-0x000000006EED0000-0x000000006F47B000-memory.dmp

    Filesize

    5.7MB

  • memory/2772-41-0x0000000002690000-0x00000000026D0000-memory.dmp

    Filesize

    256KB

  • memory/2772-39-0x0000000002690000-0x00000000026D0000-memory.dmp

    Filesize

    256KB

  • memory/2772-36-0x000000006EED0000-0x000000006F47B000-memory.dmp

    Filesize

    5.7MB

  • memory/2772-34-0x000000006EED0000-0x000000006F47B000-memory.dmp

    Filesize

    5.7MB

  • memory/2844-29-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2844-40-0x0000000004A20000-0x0000000004A60000-memory.dmp

    Filesize

    256KB

  • memory/2844-31-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2844-47-0x00000000743A0000-0x0000000074A8E000-memory.dmp

    Filesize

    6.9MB

  • memory/2844-27-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2844-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2844-24-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2844-23-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2844-21-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2844-42-0x00000000743A0000-0x0000000074A8E000-memory.dmp

    Filesize

    6.9MB

  • memory/2844-19-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/3036-6-0x0000000004D30000-0x0000000004DAA000-memory.dmp

    Filesize

    488KB

  • memory/3036-5-0x0000000000740000-0x000000000074A000-memory.dmp

    Filesize

    40KB

  • memory/3036-0-0x00000000009F0000-0x0000000000AA4000-memory.dmp

    Filesize

    720KB

  • memory/3036-4-0x0000000000590000-0x0000000000598000-memory.dmp

    Filesize

    32KB

  • memory/3036-3-0x0000000000570000-0x000000000058A000-memory.dmp

    Filesize

    104KB

  • memory/3036-2-0x0000000001F20000-0x0000000001F60000-memory.dmp

    Filesize

    256KB

  • memory/3036-1-0x00000000743A0000-0x0000000074A8E000-memory.dmp

    Filesize

    6.9MB

  • memory/3036-32-0x00000000743A0000-0x0000000074A8E000-memory.dmp

    Filesize

    6.9MB